Threat Detection Ontology

FLOW ALGEBRA
Threat Detection Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/cybersecurity/threat-detection-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "ThreatDetectionOntology" v4.0

# ---------- DOMAIN ----------
DOMAIN := ComputingOntology
SUBDOMAIN := Cybersecurity
ONTOLOGY := ThreatDetectionOntology

# ---------- PRIMARY ENTITY ----------
ENTITY ThreatDetection {
    definition:
        "The cybersecurity process of collecting, analysing and correlating
         security-relevant evidence to identify malicious, suspicious or
         anomalous activity that may represent a threat, attack or security
         incident.";

    objectives: [
        Observation,
        Identification,
        Classification,
        Alerting,
        InvestigationSupport,
        ResponseInitiation
    ];
}

# ---------- CORE ENTITIES ----------
Threat := {
    MalwareThreat,
    NetworkThreat,
    IdentityThreat,
    ApplicationThreat,
    InsiderThreat,
    DataThreat,
    InfrastructureThreat
};

DetectionSource := {
    EndpointTelemetry,
    NetworkTelemetry,
    AuthenticationLog,
    ApplicationLog,
    SystemLog,
    FirewallLog,
    SecurityEvent,
    ThreatIntelligence
};

DetectionMethod := {
    SignatureDetection,
    RuleBasedDetection,
    BehaviourDetection,
    AnomalyDetection,
    HeuristicDetection,
    CorrelationDetection,
    ReputationDetection
};

DetectionResult := {
    Benign,
    Suspicious,
    Malicious,
    Unknown
};

# ---------- FUNDAMENTAL RELATIONSHIPS ----------
ThreatDetection OBSERVES DetectionSource;
DetectionSource PRODUCES SecurityTelemetry;
DetectionMethod ANALYSES SecurityTelemetry;
DetectionMethod MAY_IDENTIFY Threat;
DetectedThreat PRODUCES Alert;
Alert INITIATES Investigation;
Investigation MAY_CONFIRM SecurityIncident;

ThreatIndicator INDICATES PossibleThreat;
ThreatIntelligence PROVIDES ThreatIndicator;

# ---------- DETECTION FLOW ----------
SecurityTelemetry ->
    Collect ->
    Normalise ->
    Enrich ->
    Analyse ->
    Correlate ->
    Score ->
    Classify ->
    AlertOrSuppress ->
    Investigate;

# ---------- TELEMETRY ----------
SecurityTelemetry := {
    Event,
    LogRecord,
    NetworkFlow,
    PacketMetadata,
    ProcessEvent,
    FileEvent,
    AuthenticationEvent,
    AccessEvent,
    SystemChange
};

TelemetrySource GENERATES SecurityTelemetry;

TelemetryQuality :=
    f(
        Completeness,
        Accuracy,
        Timeliness,
        Context,
        Integrity
    );

IF TelemetryMissing
THEN DetectionCoverage := DECREASE;

# ---------- INDICATORS ----------
ThreatIndicator := {
    FileHash,
    Domain,
    IPAddress,
    URL,
    ProcessPattern,
    FilePattern,
    RegistryPattern,
    BehaviourPattern,
    AccountPattern
};

IndicatorConfidence :=
    f(
        SourceReliability,
        Specificity,
        Recency,
        Corroboration,
        Context
    );

IF Indicator MATCHES ObservedTelemetry
THEN ThreatConfidence := INCREASE;

# ---------- SIGNATURE DETECTION ----------
SignatureDetection USES KnownPattern;

KnownPattern MAY_REPRESENT {
    MalwareSignature,
    NetworkSignature,
    FileSignature,
    ProtocolSignature
};

IF SecurityTelemetry MATCHES KnownMaliciousSignature
THEN DetectionResult := Malicious;

SignatureDetection HAS_LIMITATION ReducedUnknownThreatCoverage;

# ---------- RULE-BASED DETECTION ----------
DetectionRule :=
    ConditionSet -> DetectionAction;

DetectionAction := {
    Alert,
    Log,
    Enrich,
    Escalate,
    Suppress
};

IF ConditionSet SATISFIED
THEN Execute DetectionAction;

# ---------- BEHAVIOUR DETECTION ----------
BehaviourBaseline REPRESENTS ExpectedActivity;

ObservedBehaviour COMPARED_WITH BehaviourBaseline;

IF ObservedBehaviour DEVIATES_SIGNIFICANTLY
THEN DetectionResult := Suspicious;

BehaviourDetection MAY_IDENTIFY PreviouslyUnknownThreat;

# ---------- ANOMALY DETECTION ----------
AnomalyScore :=
    f(
        ObservedValue,
        ExpectedDistribution,
        HistoricalContext,
        PeerContext
    );

IF AnomalyScore >= Threshold
THEN AnomalyDetected := true;

Anomaly DOES_NOT_IMPLY Maliciousness;

# ---------- CORRELATION ----------
Correlation :=
    combine(
        MultipleEvents,
        SharedEntities,
        TimeRelationship,
        BehaviourRelationship
    );

CorrelatedEvidence MAY_INCREASE ThreatConfidence;

IF MultipleIndependentSignals SUPPORT SameThreatHypothesis
THEN ThreatConfidence := INCREASE;

# ---------- IDENTITY THREAT DETECTION ----------
AuthenticationEvent ->
    AnalyseIdentityBehaviour ->
    CompareHistory ->
    DetectSuspiciousAccess;

IdentityIndicator MAY_INCLUDE {
    RepeatedFailure,
    UnusualLoginContext,
    PrivilegeChange,
    CredentialAbusePattern
};

# ---------- NETWORK THREAT DETECTION ----------
NetworkTelemetry ->
    InspectFlow ->
    AnalyseProtocol ->
    CompareIndicators ->
    DetectSuspiciousCommunication;

NetworkThreat MAY_INCLUDE {
    Scanning,
    ExploitTraffic,
    CommandAndControl,
    UnauthorisedConnection,
    DataExfiltrationPattern
};

# ---------- ENDPOINT THREAT DETECTION ----------
EndpointTelemetry ->
    ObserveProcess ->
    ObserveFile ->
    ObserveMemory ->
    ObserveSystemChange ->
    CorrelateBehaviour;

EndpointThreat MAY_INCLUDE {
    MalwareExecution,
    Persistence,
    PrivilegeEscalation,
    CredentialAccess,
    SuspiciousProcessBehaviour
};

# ---------- ALERT ----------
Alert :=
    {
        DetectionTime,
        DetectionSource,
        AffectedEntity,
        DetectionRule,
        Evidence,
        Severity,
        Confidence,
        Status
    };

AlertStatus := {
    New,
    Triaged,
    Investigating,
    Confirmed,
    FalsePositive,
    Closed
};

# ---------- TRIAGE ----------
Alert ->
    ValidateEvidence ->
    DetermineScope ->
    AssessSeverity ->
    AssessConfidence ->
    Prioritise ->
    Investigate;

TriagePriority :=
    f(
        Severity,
        Confidence,
        AssetCriticality,
        ThreatContext,
        PotentialImpact
    );

# ---------- FALSE POSITIVE / FALSE NEGATIVE ----------
FalsePositive :=
    DetectionResult == MaliciousOrSuspicious
    AND ActualState == Benign;

FalseNegative :=
    DetectionResult == Benign
    AND ActualState == Malicious;

DetectionQuality :=
    f(
        TruePositiveRate,
        FalsePositiveRate,
        FalseNegativeRate,
        Coverage,
        Timeliness
    );

# ---------- INCIDENT RELATIONSHIP ----------
IF Investigation CONFIRMS MaliciousActivity
AND SecurityObjective IMPACTED
THEN SecurityIncident := Confirmed;

ConfirmedThreat ->
    Containment ->
    Eradication ->
    Recovery;

ThreatDetection SUPPORTS IncidentResponse;

# ---------- DETECTION COVERAGE ----------
DetectionCoverage :=
    SET_OF(
        ThreatTypes,
        Assets,
        Behaviours,
        AttackStages
    )
    observable_by DetectionControls;

IF CriticalAsset NOT_COVERED
THEN DetectionGap := true;

IF ThreatBehaviour NOT_OBSERVABLE
THEN DetectionGap := true;

# ---------- SEMANTIC REASONING ----------
IF KnownThreatIndicator MATCHES Telemetry
THEN ThreatConfidence := INCREASE;

IF MultipleDetectionSources CORROBORATE SameActivity
THEN ThreatConfidence := INCREASE;

IF HighConfidenceThreat TARGETS CriticalAsset
THEN AlertPriority := HIGH;

IF AlertEvidence INSUFFICIENT
THEN AlertStatus := Investigating;

IF Evidence CONFIRMS BenignActivity
THEN AlertStatus := FalsePositive;

IF DetectionRule GENERATES ExcessiveFalsePositives
THEN RuleTuningRequired := true;

IF ThreatConfirmed
THEN ResponseEvaluation := required;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "threat detection" ~= "cyber threat detection";
    "security monitoring" ~= "threat monitoring" WHEN context == cybersecurity;
    "indicator of compromise" ~= "IOC";
    "security telemetry" ~= "security event data";
    "detection rule" ~= "security detection rule";
    "alert triage" ~= "security alert assessment";
    "behavioural detection" ~= "behavior detection";
    "false alarm" ~= "false positive" WHEN context == detection;
}

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_DETECTION_SOURCE(q) ->
    IDENTIFY_TELEMETRY(q) ->
    IDENTIFY_DETECTION_METHOD(q) ->
    IDENTIFY_THREAT_INDICATOR(q) ->
    IDENTIFY_ALERT(q) ->
    MAP_TO_ONTOLOGY(q) ->
    APPLY_REASONING(q) ->
    SCORE_CONFIDENCE(q) ->
    RETURN_RELEVANT_KNOWLEDGE;

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        source_reliability,
        telemetry_quality,
        evidence_strength,
        corroboration,
        semantic_consistency,
        contextual_relevance
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: ThreatDetection;
    ontology: ThreatDetectionOntology;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_detection_source:
        validate
        -> classify
        -> identify_telemetry
        -> map_detection_coverage
        -> integrate;

    new_indicator:
        validate
        -> classify
        -> score_reliability
        -> associate_threat
        -> integrate;

    new_detection_rule:
        validate
        -> parse_conditions
        -> identify_threat
        -> evaluate_coverage
        -> integrate;

    detection_revision:
        update_rules
        -> update_indicators
        -> recompute_detection_quality
        -> recompute_confidence
        -> regenerate_flow_hash;

    conflict:
        preserve_provenance
        -> compare_evidence
        -> adjust_confidence
        -> flag_review;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + Threat
    + DetectionSource
    + DetectionMethod
    + DetectionResult
    + ThreatIndicator
    + Alert
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
ThreatDetectionOntology
    -> CollectSecurityTelemetry
    -> NormaliseEvidence
    -> EnrichContext
    -> ApplyDetectionMethods
    -> CorrelateSignals
    -> IdentifyThreatIndicators
    -> ScoreThreatConfidence
    -> GenerateAlert
    -> TriageAlert
    -> InvestigateThreat
    -> ConfirmOrRejectDetection
    -> InitiateSecurityResponse;

END FLOW